AI Watermarking: How It Works and Why It Is Not a Silver Bullet

What AI Watermarking Tries to Do

AI watermarking is a technique that embeds a hidden statistical signal into text as a model generates it. The idea is elegant: when the model picks each word, it slightly biases its choices in a pattern that is invisible to readers but detectable with the right key. Later, anyone with that key can check whether a piece of text carries the watermark and conclude it came from that model.

This sounds like a clean solution to the provenance problem. If every AI model watermarked its output, detection would be trivial and false accusations would disappear. The reason watermarking is not widespread has nothing to do with the theory and everything to do with the practical limits that undermine it in the real world.

How a Text Watermark Actually Works

1. 1
   The model splits its vocabulary into green and red tokens

   At generation time, the model is nudged to prefer green-list tokens over red-list ones. The split is determined by a secret key, so the bias pattern is unique to whoever holds it.

2. 2
   Generated text carries a slight statistical imbalance

   Because green tokens appear more often than chance would predict, the resulting text carries a measurable signature. The imbalance is too subtle for a human to notice while reading.

3. 3
   A detector checks for the imbalance

   Given a sample, the detector counts how often green tokens appear versus red. A statistically significant excess indicates the text was watermarked by that key's model.

Watermarking vs. Statistical Detection

Why Watermarking Has Not Solved Detection

• It only works if the generating model opts in, and open-weight models anyone can run locally do not
• Edits, paraphrasing, translation, or a rewrite pass erase the watermark
• Competing models would each need their own watermark scheme and a shared detection standard
• Bad actors can strip watermarks deliberately by forcing red tokens, defeating the signal
• Watermark detection produces its own false positives, just like statistical detectors

The Open-Model Loophole

Even if every major commercial model watermarked its output perfectly, the approach has a fatal gap: open-weight models. Models that anyone can download and run locally are not controlled by a company that can enforce watermarking at the generation step. A person running an open model on their own hardware can disable, ignore, or never implement a watermark. As open models approach the quality of commercial ones, watermarking as a universal detection strategy loses its foundation.

This is the core reason watermarking is discussed as one tool among many rather than the solution. It can help trace output from cooperating, closed models in controlled settings. It cannot, on its own, tell you whether an arbitrary piece of text came from an AI.

What This Means for Writers and Reviewers

For anyone on the receiving end of a detection accusation, watermarking is mostly irrelevant to your situation. The detectors used in schools and workplaces are statistical pattern matchers, not watermark readers, and they are the ones producing false positives on human writing. Understanding the difference matters because it changes what evidence is meaningful.

If you are accused of using AI, the relevant question is not whether your text carries a watermark, because it almost certainly was not checked for one. The relevant question is what the statistical detector measured and why. Documenting your drafting history, your edits, and your sources is far more useful than arguing about watermark theory. The technology that flags you is probabilistic and fallible, and the best defense is a record of a genuine writing process, not a debate about signals you cannot control.

Watermarking Realities